FireBrick FB6402, Руководство пользователя

Страница: 142 / 196

125
Appendix G. Hashed passwords
The configuration XML includes passwords and OTP seeds encoded using hashes, this makes it impossible to
extract the password from the config.
Caution
It is still important to keep the configuration hashes safe, as someone could use the hashes to try
millions of passwords off-line before trying to log in to a FireBrick. For this reason it is also important
to use good passwords that cannot be guessed, and are not simply made from normal dictionary words.
G.1. Password hashing
The
user
section of the configuration has a
password
field. You will note that is it mostly a lot of
hexadecimal data, the hash, as described below.
It is possible to put a new password in to the configuration directly in the
password
field and save the config.
It will be hashed automatically so when you access the configuration you will see the hashed version in the
password
field. However, this is not possible if you also have an
otp-seed
defined, unless also setting a
new
otp-seed
field or removing it. For this reason there is also a web page to allow a user to change their
password.
Tip
We recommend you use the web page to change the password for a user, and in fact, that the user
themselves do this, so as the administrator does not know the password.
The FireBrick supports a number of hash functions for passwords, but on any successful login may change
the config to use the current preferred password hash function. This allows FireBrick to move to more secure
password hash functions in future whilst maintaining backward compatibility.
If making a configuration file independantly you can generate the hashes yourself in most cases. The supported
hash codings are as follows. For salted hashes, the salt is the additional bytes after the number of bytes for
the hash.
• FB105#[10 bytes of hex]: A legacy for the old FB105 password hashing, used by the FB105 conversion tool.
• MD5#[16 to 19 bytes of hex]: The first 16 bytes are an MD5 hash of the password appended with up to 3
bytes of salt.
• SHA1#[20 to 31 bytes of hex]: The first 20 bytes are an SHA1 hash of the password appended with up to
11 bytes of salt.
• SHA256#[32 to 47 bytes of hex]: The first 32 bytes are an SHA256 hash of the password appended with
up to 15 bytes of salt.
The preferred hash is SHA256 with 15 bytes of salt. However, this may change in the future to more robust
password functions.
G.1.1. Salt
A hash function simply takes some data, and generates a hash from it - as a one-way process. This ensures that,
given the hash, you cannot work out the original string (normally a password).
However, a particular string (e.g. password) always generates the same hash. As such it is possible for people
to have huge tables of pre-calculated hashes for common passwords and dictionary words. This allows such
(poor) passwords to simply be looked up from a hash.